Fix SSRF (Server Side Request Forgery) in Spring WebFlux

SSRF in the reactive world is a silent killer. In Spring WebFlux, an unvalidated WebClient request allows an attacker to pivot from the public internet into your private VPC, hitting internal metadata endpoints (like 169.254.169.254) or unauthenticated microservices. If you're piping raw user input into a URI builder without a whitelist, you're handing over the keys to your internal network.

The Vulnerable Pattern

@GetMapping("/fetch")
public Mono fetch(@RequestParam String url) {
    // DANGER: User controls the entire URL. 
    // Attacker can pass 'http://169.254.169.254/latest/meta-data/'
    return WebClient.create(url)
            .get()
            .retrieve()
            .bodyToMono(String.class);
}

The Secure Implementation

The fix enforces a strict allow-list policy. Instead of creating a WebClient instance per request (which is inefficient), we use a pre-configured WebClient and validate the URI host against a trusted list before execution. For robust defense-in-depth, implement a custom ExchangeFilterFunction that resolves the hostname to an IP and blocks RFC 1918 (private) addresses and cloud metadata IPs at the socket level to prevent DNS rebinding attacks.

private static final List ALLOWED_DOMAINS = List.of("api.partner.com", "trusted-service.internal");
@GetMapping(“/fetch”)
public Mono fetch(@RequestParam String url) {
return Mono.just(url)
.map(URI::create)
.filter(uri -> ALLOWED_DOMAINS.contains(uri.getHost()))
.switchIfEmpty(Mono.error(new ResponseStatusException(HttpStatus.BAD_REQUEST, “Illegal Target”)))
.flatMap(uri -> webClient.get()
.uri(uri)
.retrieve()
.bodyToMono(String.class));
}